home

firefox-13108-dp.exe

Installer application

dobreprogramy sp. z o.o.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application firefox-13108-dp.exe, “Installer application Setup ” by dobreprogramy sp. z o.o has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as the free Mozilla Firefox web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Installer Soft Program   (signed by dobreprogramy sp. z o.o.)

Product:
Installer application

Description:
Installer application Setup

Version:
4.6.4.0

MD5:
9251e55e1ae27c184d2eea66a4a4557e

SHA-1:
fb672bf092ea7e95842b71c4a570d61d9d3abac7

SHA-256:
1400ff65a501aa565966460a846663e478a219064c641db358541628a6623a5d

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/23/2024 9:26:31 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.dobreprogramyspzoo.Installer (M)
16.1.31.20

File size:
939.6 KB (962,128 bytes)

Product version:
1.1

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\firefox-13108-dp.exe

Digital Signature
Signed by:
dobreprogramy sp. z o.o.

Authority:
GlobalSign nv-sa

Valid from:
2/13/2015 5:34:27 PM

Valid to:
2/14/2016 5:34:27 PM

Subject:
CN=dobreprogramy sp. z o.o., O=dobreprogramy sp. z o.o., L=Wroclaw, C=PL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121B4F3A4313F8A58B614202F80129EBC93

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:TK0MnOP4OXqwVfMacL/BLLpQ/VWVSiPmBuJFTs9QOY4I:T1mOuacL/VLh/PmBuDTslE

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file firefox-13108-dp.exe has been seen being distributed by the following 15 URLs.

http://www.softwaregiftconecpt.com/c?x=XKUCILppeD4149q0imc2CJ/Pk1o7Q1889YtqjhDfwM8=&c=dqGllMe13nzZPZQykLIpHsmPbXGiTIxIissHSXwu9HgZyxjzFWkYxUq8s69JyGGcblYY78Gb Jkd9bRwQFP hcuUBD4Liq1ocfysW/z9Sb5yex0zc8UNCpS2UC1qxUn 4 KXiXm4O1AnM8tVC2eIkQ==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.bestchucklegift.com/c?x=jruzgJbc8ohjZLspoFje0YQlUgst4zJ0qjM5CHM2m/k=&c=ZWtLQWppexQJmFqzAR9FcFPeNFwfFjIi8TvPI0hpnIe6yYhROa6ey0noNy7NxR76qvQiyTfeImuK4xQrOZDtP XKNK/x E6hDCxMjkvSm2FS8M/ccl/98x5fKaEoEqXzfoq7sFE9mnBW ExcckbKwg==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.dashdownloadscenters.com/c?x=U7VzIznVQ3O8LWCLhjkpULhH/AwMvJDAVBjn2ODxKvY=&c=Z0pTNd3AT9CmGW/WT9EfRWkSw8HkCgMQemHYlI0iaIjfTnEqn47Yr6o7NURBWOmDp0uzJLZN6oOcvbAYvfCDTWIRvq7uBx6HmmnfaDnytgLAd2rXKQMD/oyAM3TY45HmjtB2kC 2Ecl8eqc1DKuZnw==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.dashdownloadscenters.com/c?x=yHAAe Ng/SH9g2uJQ1Vy98EP 0t5sBqpYEyhNaLOItA=&c=QulGymW2mJhWhYbatDPzE y2qeqwYpi87HVu8GqM47lm5nnsH9JZna2wemSwsptynZrm LKwVF7OfeY/YiRs8yWxAMlaDVqzVUWBzfscy8HZ9xssHGfF88U5d8Bx cgqJlqwYQn93CqQpv8nK0KEVQ==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.softwaregiftconecpt.com/c?x=LexkeBQtpi7OI/YekvQr3C0i5W2T5sBr6CE X1j0hpM=&c=Mf5R vpdaGOhlaIR2I3/UsRxavTCP GJkKrxswQHLlwbkDK4ze7YwS8XJgg427L/zvYGo12NTQNqn0ndJELdRkyGrD7Cu7AzhfSqMGUPdF3qWg8xU0419NCONseYPvoQH1644/lbgeh9eAQPcwJT5Q==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.cleantodaymega.com/c?x=e 7a76vpIkb0yUPHcdsT4O HK9p K3bfTYhleLlHgX4=&c=8GjnU8YX9lk5OEX53H9ehLD8ibIuVdjCmwpBSe/D36U5aPvqVz5TtEFw2l7N7VYP5YujfD6qp/AlBajki1iJrJUixoUXN1gI1Uo4tYgBk0DwVCEgi8XDqnAX8KepZ32U2t5aSsIN0QSwjIm7h GrRw==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.dashdownloadscenters.com/c?x=KKiBKyUrYHQePG54epeKzWa5BKnh48rjCcfp/cFShMA=&c=5sTzrXOnF/P5wQsfjDcwFj93gALXUXxMblZ0r7KHS1Rc48LKiDFLUxFeEXRzoLdsCJjFu65IkFr1HNTxKqq0sBBWs9j8mtYgAnKdzD0z0cs8zqZg0TzEYMPRwVqL /JnevWk5JDr9XZ7t7Bd bq22A==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.tagvaultsclean.com/c?x=HIyIIatCrXzfeunqybHEn3TdlmgxxGuavcPfFZkARO0=&c=qvzdG/13rOG6s39abxOk29mKJcRxjZsMtNZZGNUBMfJbyO3Mn4qED3rJ/67OMhT9pBOysprKgK/FOo1iQHs4WTB VvkcGvnz4HLskw8AbaZCXuzCQClv3SWWw5SfdUXZ&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.tagvaultsclean.com/c?x=ZnoV5hQU9Dq79yf4DkseS2Uxxbw3fzNhsmNOJYWmK9A=&c=7sKDnffqo0U QurJ0Tvs5M2wjrZL/ykxHg3dVu8NuT6t/080X9F2w5TXiEiSBXk257xANnVby Vel4tRnuAjBrfGrRdj51jrKncsD QBvy0VcrgpSQuAn6GNXBssJjAix4T8ZQNMB9Y3EZEeys3bpQ==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.vaultsconecptnew.com/c?x=F0/m1MYNMGHDGu9W7 ofmXV/NZLTuXPQ8LLphkYad0o=&c=UWsFVEodi4CZTHt tq6sV2/DpJIBJft4Q5heHoxhgxBOvmrei1MurcVtdPtUfEE4m/JG57ZqoCFV9IrsSFzCXn683BWM6YXhJZOEWioIfNUu9HNvNMgN4lNXcs1WHmYeZaWph 76iTafTGceLPQkIQ==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.downloadsendtours.com/c?x=JVp1FJXGWMVw7BpMIuI3RIYIMkimKOLtn36N8tWRopY=&c=nKwmrPFPnCNW7AeAIJOf9RsLTj54LLfnB0Z3KmnAHfrW4kuP/VuD0siHf83MKl0M8Q6QGXh3wBRsDpRUypcaO4qrsAAi9O2VuTdjZDULqdexVy2 egVp55nQfUO4INpJqEmdGRvNa8MDlwWToEZE7A==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.tagvaultsclean.com/c?x=BU87nk pfbPxgCgxB0r12fsut78zW6k3NJrX0AMeErY=&c=ZmqAAbwWA42pYPuOK/eZ1MZa4jEXcT2VKXgMSZtv3QroA99M5kPJ/z4Lr6VaVpTRHgzNC/X39IE1z1Ginb1y6pHnd43HncCQQflIWzt PFYKrbdMZ5lTOIo7wkJm8vl6GALELyYEASPrxMY9HTPaug==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.dashdownloadscenters.com/c?x=7lP3vpJ10hKkA4aDzRPZT dS l0dAZnGCeEjkJGGib0=&c=KiE88wYfM4MeonmwkgUMHed J7FCUCGzBUT1AuKCi 7OKCCrQ2Sm0HA2dmweC9kHtuSKhFExXD7OFuT6pMhRN8eoRJJYm0TGigqJ6ek9CXn RLEN rCawU XiZwyuQ7TOKq1eQS2yW5BGVZxMC2ZUA==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.universefactoryquick.com/c?x=6rs/YaOPp9QjHKpJ6EPNt348RYeUaoxSxfbhGjkgWqc=&c=gFqb00disE2ZtlU9vXRjGBaa8evfjlTIUOIbD5PN8AZn9N4/ FB1dZhA jU6ECvi19XXgUqoO1T85PHODVY/EX2FxQx23K07xe19Xa4tIbWL/A4zWJBKJVS0 uqkx2wPaqz/QZ2yHON7JXVlFh8Cyw==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.dashdownloadscenters.com/c?x=qVAPaFR5sFMK//TzlZ/OPyBC3PNOaeuWZ7hprfuaOLw=&c=0GfVeLuz1tBhIbV9dgkKN /pt2RvRsx4Dg52HIsANt0pj7Z36XDOjzlRahWdxF5 3 SrfpkZSroZBoCDRRcD72P1x7oDoqZM0zuJlj/XUz4LUswjKMVeVuAyL5HC yTv8aADi1uPp7FSz06Xr0tOyw==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

Remove firefox-13108-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.